About this plugin
If your domain’s mail lives in Microsoft 365, your WordPress server doesn’t need SMTP credentials, an SMTP relay or PHPMailer configuration. Sendelva sends everything that goes through wp_mail(), such as password resets, form notifications and order emails, through the Microsoft Graph sendMail endpoint with an app-only OAuth token. Messages go out from your real tenant and appear in the sender mailbox’s Sent Items.
How it behaves
- Nothing changes until it’s configured. While any of the four credentials is missing, WordPress mail works exactly as before.
- Fails safely. With fallback on (the default), a Graph error hands the message back to WordPress’s own mailer instead of dropping it. With fallback off, the send fails and wp_mail_failed fires.
- Behaves like WordPress’s own mailer. HTML switched on with the wp_mail_content_type filter (how WooCommerce and most form plugins do it) or a Content-Type header is sent as HTML, and wp_mail_succeeded fires after each successful send, so mail logging plugins keep working.
- HTML, Cc, Bcc, Reply-To and attachments up to the 3 MB sendMail request limit. Every address in a header such as Cc: [email protected], [email protected] is delivered, display names are kept, and an attachment keyed by name (WordPress 6.2 and newer) is sent under that name.
- Mail goes out as the sender mailbox. Microsoft Graph sends as the configured mailbox, so a From header set by another plugin is ignored. Set Reply-To to send replies elsewhere, such as to a contact form visitor.
- Tokens are cached and refreshed two minutes before they expire. A cached token is only used with the credentials it was issued for, and saving the settings clears it. If Microsoft refuses a token, the plugin waits a minute before asking again rather than holding up every email.
- A send log on the settings screen keeps the last 20 messages, successes and failures alike, with Microsoft’s error message for any that failed.
- A test message button, a setup checklist that ticks itself off, and a step-by-step Microsoft Entra guide you can show or hide.
- Secrets can stay out of the database. The client secret field is write-only, and all four settings can be defined as constants in wp-config.php instead.
External services
Sendelva connects to two Microsoft services. It makes no requests until all four settings (tenant ID, client ID, client secret and sender mailbox) are filled in.
com ) issues the access token Sendelva uses to send mail.
- When: before the first email is sent, then whenever the cached token is about to expire (tokens last about an hour) or the settings change.
- What is sent: your tenant ID, client ID and client secret, and the requested scope ( https://graph.microsoft.com/.default ).
com ) delivers the email.
- When: every time WordPress sends an email while Sendelva is configured, including test messages from the settings screen.
- What is sent: the access token, the sender mailbox, and the message itself: its recipients (To, Cc, Bcc and Reply-To, with display names), subject, body and any attachments.
Both services are provided by Microsoft. Use of them is covered by the Microsoft APIs Terms of Use, the Microsoft Services Agreement and your organization’s Microsoft 365 agreement, and Microsoft’s handling of the data is described in the Microsoft Privacy Statement.
The settings screen also links to pages in the Microsoft Entra admin center and Microsoft’s documentation. Those are ordinary links that open only when you click them.